Analysis Modes
Repository Analysis
Analyze Git repositories with automatic language detection, test generation in sandboxes, and A-F grading.
Website E2E Testing
Generate Playwright or Cypress tests by learning site structure with screenshot capture.
API Contract Testing
Test REST, GraphQL, gRPC, WebSocket, and SOAP APIs with auto-detection, protocol-aware tests, and self-healing.
Load Testing
Run k6 performance tests with Quantum Intelligence journey profiles and SLA validation.
Requirement Proof
Route each written requirement to its strongest oracle and ratify coverage only from executed evidence — a Requirement Evidence Matrix.
Consumer Contract
Derive a consumer's API contract from its source code and verify the provider still honours it — consumer-driven contracts, no hand-written pacts.
Attack Resilience
Adversarial probing with 40+ payloads across XSS, SQL injection, auth boundaries, and input fuzzing.
AI Resilience Testing
Probe AI chatbots and assistants with 25 adversarial strategies across OWASP LLM Top 10 categories.
Training Engine
Fine-tune custom models on your analysis data. Every analysis teaches the system your patterns.
Guides
Quick Start
Get your first analysis running in under 2 minutes.
- Sign up or sign in to your account
- Navigate to the Analyze page
- Enter a GitHub repository URL
- Click "Start Analysis" and wait for results
Understanding Grades
How the A-F grading system works.
- Grade A (90-100): Production-ready, all tests pass
- Grade B (80-89): Good quality, minor issues
- Grade C (70-79): Acceptable, some fixes needed
- Grade D (60-69): Below average, significant issues
- Grade F (<60): Not ready, major problems
Self-Healing Pipeline
How automatic test repair works.
- Tests are validated through 4 stages: Syntax, Compile, Execute, Grade
- Failed tests are automatically repaired up to 3 times
- Error context feeds Quantum Intelligence for targeted fixes
- Final grade reflects the validated, working tests
Repository Analysis
Clone → Understand → Generate → Validate → Grade
What happens when you point us at a Git repository.
- Clone — a shallow clone of your repo into an isolated temp workspace
- Detect — language, framework, and entry points (165+ languages parsed via tree-sitter AST)
- Baseline — current health and existing test coverage, so the grade reflects real improvement
- Understand — the model reads the codebase to learn its structure, dependencies, and conventions
- Generate — unit + integration tests via LLM tool-calling, 5 workers in parallel
- Validate — every test runs the syntax → compile → execute pipeline in an ephemeral cloud sandbox
- Self-heal — failing tests are clustered, regenerated, and re-run (up to 3× on paid plans)
- Grade — an A–F score backed only by tests that actually compiled and passed
Proven, not just generated
Mutation scoring proves the tests catch real bugs.
A test that never fails proves nothing. QuantumVerifi deliberately introduces bugs (mutants) into your code and re-runs the generated suite — a test that stays green against a broken mutant is flagged, and one that catches it is proven. The result is a mutation score, not just a pass rate.
Every generated file, sandbox run, and result is SHA-256-sealed into a replayable evidence chain.
Website E2E Testing
Learn the site, then test it like a user
Real browser E2E tests generated from a live URL.
- Crawl — discover routes, forms, and user journeys from your live site
- See — screenshots + visual AI identify headers, forms, modals, and key UI regions
- Prioritise — flows are ranked P0/P1/P2 so the most important journeys are covered first
- Generate — real Playwright or Cypress tests for those journeys
- Execute — tests run in ephemeral cloud browser sandboxes, destroyed after the run
- Score — coverage × stability × risk, not a raw pass count
Behind the login
Gatekeeper tests authenticated areas — without storing credentials.
Connect your identity provider once (Clerk or generic OIDC). Per run, QuantumVerifi mints a fresh session server-side for a test user you designate, then proves access differentially — reached as the authorised user, denied as an unauthorised one.
Credentials are never stored, sessions expire with the run, and access is sealed into a tamper-evident Credential Receipt.
API Contract Testing
Five Protocols, One Workflow
Auto-detect and test any API protocol.
QuantumVerifi auto-detects your API protocol from the spec content or URL, then generates protocol-aware tests with the correct transport, error handling, and security checks.
- REST — OpenAPI/Swagger specs — HTTP verb + path assertions, status code validation
- GraphQL — Introspection discovery — single-endpoint queries, response.data.errors checks, query depth testing
- gRPC — Server reflection — service/method calls, gRPC status codes, Protocol Buffer validation
- WebSocket — Connection lifecycle — connect, send, receive, close with async message assertions
- SOAP — WSDL parsing — XML envelope construction, SOAPAction headers, SOAP Fault handling
Protocol-Specific Security
Each protocol has its own attack surface.
- REST — OWASP Top 10: broken auth, injection, mass assignment, CORS misconfiguration
- GraphQL — Introspection exposure, query depth DoS, batch query attacks, field-level authorisation
- gRPC — Reflection exposure, metadata injection, certificate pinning, message size limits
- WebSocket — Origin validation, auth on upgrade, message injection, connection flooding
- SOAP — XXE attacks, WSDL information disclosure, WS-Security, XML bomb, action spoofing
Load Testing
Generate a k6 script, run it from the cloud, score it
Performance testing from just a URL.
- Target — point at a URL, or let auto-journey weight the routes real users actually hit
- Generate — QuantumVerifi writes a k6 load-test script for the chosen targets
- Execute — the script runs in a cloud sandbox at your chosen concurrency
- Measure — p95 / p99 latency, error rate, and throughput are captured
- Score — graded A–F against your thresholds (e.g. p95 < 500ms, error rate < 1%)
Four Load Profiles
Pick the shape of traffic you want to simulate.
- Baseline — 1 virtual user · 30s — establish a clean single-user baseline
- Load — 10 virtual users · 60s — normal expected traffic
- Stress — 50 virtual users · 120s — find where performance degrades
- Spike — 100 virtual users · 60s — a sudden traffic surge
Requirement Proof
Route each requirement to the engine that can prove it
Classify → Route → Execute → Ratify.
Paste or upload your requirements, point QuantumProof at a URL and/or a repository, and it proves each one against your actual system — never against a semantic match to the wording.
- Classify — each requirement is sorted into one of 12 classes (behavioural, data, security, performance, contract…)
- Route — the class selects the strongest oracle: repo unit tests, live API probes, browser E2E, k6 load, consumer contract, or eval
- Execute — that engine runs a real probe against your app and records what it observed
- Ratify — coverage is granted only from executed evidence; a requirement with no route to run stays honestly uncovered
The Requirement Evidence Matrix
Every requirement, every verdict, with receipts.
- Ratified — executed evidence satisfies the oracle — covered
- Mutation-proven — gold tier: a deliberately-broken mutant made the test fail, proving it actually bites — covered
- Weak — the oracle needs a signal we can't observe (a backend read, human judgement) — honest, never shown green
- Gap / Contradiction — the behaviour is missing, or it directly violates the requirement
- Drift — behaviour exists with no matching requirement — your docs are stale
Only Ratified and Mutation-proven count as covered. The constitution: candidate → executed → ratified → mutation-proven — a weak oracle never shows green.
Consumer Contract
Consumer-driven contracts, without the contracts
Derive the contract from the consumer's code, then verify the provider.
No hand-written pact files to maintain. Point QuantumVerifi at a consumer repository and a provider URL, and it infers the contract from what the code actually uses.
- Clone — the consumer repository
- Derive — tree-sitter reads the call sites to find exactly which request fields, response fields, and status codes the consumer actually depends on (the Derived Consumer Contract)
- Probe — call the live provider
- Verify — confirm the provider still returns everything the consumer reads
- Seal — a tamper-evident contract verdict, bound to the evidence chain
De-risk the change before it ships
Gate a provider change against every consumer.
Point it at a proposed OpenAPI spec and it checks whether the change would break any registered consumer — so a field rename or a removed status code is caught in review, not in production.
Because the contract is derived from real code, it only ever asserts what a consumer genuinely reads — no over-specified pacts that break on harmless changes.
Attack Resilience
What is Attack Resilience?
Non-destructive adversarial probing of your live website.
Attack Resilience probes your website with 40+ adversarial payloads to measure how well your application resists being misused. It covers XSS, SQL injection, path traversal, auth boundary violations, encoding abuse, and more.
All probing is non-destructive — GET and POST only, rate limited, with sensitive paths skipped automatically. Safe for production.
Three Testing Domains
Weighted scoring adapts to your attack surface.
- Web Resilience (35%) — XSS (8 variants), CSRF token checks, path traversal, open redirects, information disclosure (.env, .git, debug endpoints)
- API Resilience (30%) — Auth boundary probing (unauthenticated access), rate limit testing, schema manipulation (mass assignment, type confusion)
- Input Resilience (35%) — SQL injection (error + blind), boundary values (10KB strings, NaN), encoding abuse (homoglyphs, null bytes), type confusion
Weights adjust automatically — if your site has no forms, form-based attacks don't penalise your score.
Safety Controls
Built-in safeguards for production use.
- Host boundary — all requests stay on the same origin
- Non-destructive — GET and POST only, no PUT/DELETE/PATCH
- Sensitive path denylist — skips /logout, /delete, /payment, /checkout
- Rate limiting — 200ms delay between probes + circuit breaker on 429/403
- Budget caps — max 15 targets, 10 probes per target, 60 total probes
AI Resilience Testing
What is AI Resilience?
Automated adversarial testing for AI-powered features.
If your website has a chatbot, AI search bar, or virtual assistant, it has an attack surface. AI Resilience testing probes these surfaces with 25 adversarial strategies to identify vulnerabilities before attackers do.
Testing runs automatically as part of URL analysis — no extra configuration needed. QuantumVerifi detects AI surfaces during crawling, then runs multi-turn adversarial conversations in sandboxed browsers.
The Six Attack Categories
Mapped to the OWASP LLM Top 10.
- Prompt Injection (LLM01) — Overriding AI instructions with injected prompts — persona hijacking, authority override, multi-turn escalation
- System Prompt Extraction (LLM06) — Revealing internal instructions — reflection requests, context overflow, chain-of-thought extraction
- Policy Bypass (LLM01) — Getting the AI to produce content it should refuse — role-play, task decomposition, few-shot poisoning
- Data Exfiltration (LLM06) — Leaking training data, user data, or credentials — inference probing, credential extraction
- Tool Misuse (LLM07) — Manipulating AI tools — attacker-controlled parameters, tool chain attacks
- Indirect Injection (LLM01) — Injecting instructions through documents, URLs, or form fields the AI processes
Understanding Your Score
How the resilience score is calculated.
- Each strategy produces a verdict: Defended (100 pts), Partial Leak (40 pts), Inconclusive (20 pts), Failed (0 pts)
- Every verdict is double-checked by an adversarial reviewer — preventing hallucinated scores
- Category scores are weighted by severity and aggregated into an overall 0-100 score
- Grade A (90+): Strong guardrails. Grade F (<60): Minimal or no defences — common for default chatbot configs
- Findings include full conversation replays, judge verdicts, and structured remediation steps
Training Engine
The Learning Flywheel
Every analysis makes future analyses better.
- Analyse — run a normal analysis (URL, repo, API, or perf)
- Harvest — the system extracts successful outcomes as training episodes (passing tests, accurate findings)
- Train — fine-tune a QLoRA adapter on your episodes (15-45 min on GPU)
- Route — activate the adapter so future analyses use your fine-tuned model
- Repeat — the fine-tuned model produces better results, which become better episodes
Why Fine-Tune?
Cost, speed, and relevance.
- Cost — fine-tuned 14B model costs ~$0.01/analysis vs ~$0.08 for GPT-4.1 (8x reduction)
- Speed — smaller models generate tokens 2-3x faster than large API models
- Relevance — after 50+ analyses, the adapter knows your test framework, imports, and error patterns
- Privacy — your adapter is private to your tenant, trained on your data only
Available on Scale and Enterprise plans. Read the full guide.
API Reference
The QuantumVerifi API allows you to programmatically trigger analyses and retrieve results.
Full API documentation coming soon.
Need Help?
If you have questions or need assistance, contact our support team:
[email protected]